Merge lp:~ted/ubuntu-app-launch/untrusted-helper into lp:ubuntu-app-launch/14.04

[Ted Gould]

Support for Untrusted Helpers

Adds support for a new job class nicknamed "untrusted helper" These are more freeform to be used by the infographic visualization work and others. It provides upstart to do the management and setup the PID while allowing the manager to install a plugin to find the exec line needed for their project.

Also did some reshuffling putting things into directories, probably need more, but this branch is a start.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:126
http://jenkins.qa.ubuntu.com/job/upstart-app-launch-ci/218/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-amd64-ci/77
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-armhf-ci/77
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-i386-ci/78

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/upstart-app-launch-ci/218/rebuild

review: Approve (continuous-integration)

[lp:~ted/ubuntu-app-launch/untrusted-helper]

127. By Ted Gould on 2014-01-29

Merge trunk

128. By Ted Gould on 2014-01-29

Grabbing the MR Policy branch

129. By Ted Gould on 2014-01-29

Add a verification step and a test case for untrusted helpers

130. By Ted Gould on 2014-01-31

Update to trunk

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:130
http://jenkins.qa.ubuntu.com/job/upstart-app-launch-ci/230/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-amd64-ci/89
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-armhf-ci/89
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-i386-ci/90

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/upstart-app-launch-ci/230/rebuild

review: Approve (continuous-integration)

[lp:~ted/ubuntu-app-launch/untrusted-helper]

131. By Ted Gould on 2014-02-05

Update description for a better idea of where the AppArmor profile comes from

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:131
http://jenkins.qa.ubuntu.com/job/upstart-app-launch-ci/235/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-amd64-ci/94
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-armhf-ci/94
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-i386-ci/95

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/upstart-app-launch-ci/235/rebuild

review: Approve (continuous-integration)

[Charles Kerr (charlesk)]

Looks pretty good, especially the documentation of the public API. Nice!

Only a couple of points:

Needs-fixing: start_helper_core() leaks the variable 'urisjoin'

Just-nagging: untrusted-helper-type-end.c calls g_strv_length(instances) more often than necessary

review: Needs Fixing

[Ted Gould (ted)]

On Wed, 2014-02-05 at 18:54 +0000, Charles Kerr wrote:

> Needs-fixing: start_helper_core() leaks the variable 'urisjoin'

Fixed r133

> Just-nagging: untrusted-helper-type-end.c calls g_strv_length(instances) more often than necessary

Fixed r134

Also, pulled through application-job-to-c changes to resolve conflicts.

[lp:~ted/ubuntu-app-launch/untrusted-helper]

132. By Ted Gould on 2014-02-05

Merging application-job-to-c to resolve conflicts

133. By Ted Gould on 2014-02-05

Make sure to free the created URIs join string

134. By Ted Gould on 2014-02-05

Save a count of the instances

[Charles Kerr (charlesk)]

review: Approve

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:134
http://jenkins.qa.ubuntu.com/job/upstart-app-launch-ci/238/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-amd64-ci/97
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-armhf-ci/97
    SUCCESS: http://jenkins.qa.ubuntu.com/job/upstart-app-launch-trusty-i386-ci/98

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/upstart-app-launch-ci/238/rebuild

review: Approve (continuous-integration)

[lp:~ted/ubuntu-app-launch/untrusted-helper]

135. By Ted Gould on 2014-02-13

Merge trusty-proposed

136. By Ted Gould on 2014-02-14

Helper GIR annotations enhancement

=== modified file '.bzrignore'
--- .bzrignore	2013-05-04 00:38:13 +0000
+++ .bzrignore	2014-02-14 02:01:23 +0000
@@ -1,1 +1,6 @@
-desktop-exec
+CMakeCache.txt
+CMakeFiles/
+CTestTestfile.cmake
+Makefile
+cmake_install.cmake
+*-trace.[ch]

=== modified file 'CMakeLists.txt'
--- CMakeLists.txt	2014-02-11 03:14:30 +0000
+++ CMakeLists.txt	2014-02-14 02:01:23 +0000
@@ -76,51 +76,6 @@
 target_link_libraries(helpers ${GIO2_LIBRARIES} ${JSONGLIB_LIBRARIES})
 
 ####################
-# upstart-app-list
-####################
-
-add_executable(upstart-app-list upstart-app-list.c)
-set_target_properties(upstart-app-list PROPERTIES OUTPUT_NAME "upstart-app-list")
-target_link_libraries(upstart-app-list upstart-launcher)
-install(TARGETS upstart-app-list RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
-
-####################
-# upstart-app-launch
-####################
-
-add_executable(upstart-app-launch upstart-app-launch.c)
-set_target_properties(upstart-app-launch PROPERTIES OUTPUT_NAME "upstart-app-launch")
-target_link_libraries(upstart-app-launch upstart-launcher)
-install(TARGETS upstart-app-launch RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
-
-####################
-# upstart-app-watch
-####################
-
-add_executable(upstart-app-watch upstart-app-watch.c)
-set_target_properties(upstart-app-watch PROPERTIES OUTPUT_NAME "upstart-app-watch")
-target_link_libraries(upstart-app-watch upstart-launcher)
-install(TARGETS upstart-app-watch RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
-
-####################
-# upstart-app-pid
-####################
-
-add_executable(upstart-app-pid upstart-app-pid.c)
-set_target_properties(upstart-app-pid PROPERTIES OUTPUT_NAME "upstart-app-pid")
-target_link_libraries(upstart-app-pid upstart-launcher)
-install(TARGETS upstart-app-pid RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
-
-####################
-# upstart-app-stop
-####################
-
-add_executable(upstart-app-stop upstart-app-stop.c)
-set_target_properties(upstart-app-stop PROPERTIES OUTPUT_NAME "upstart-app-stop")
-target_link_libraries(upstart-app-stop upstart-launcher)
-install(TARGETS upstart-app-stop RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
-
-####################
 # desktop-exec
 ####################
 
@@ -188,36 +143,13 @@
 install(TARGETS application-failed RUNTIME DESTINATION "${pkglibexecdir}")
 
 ####################
-# application.conf
-####################
-
-configure_file("application.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application.conf" @ONLY)
-install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
-add_test(application.conf.test "${CMAKE_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application.conf")
-
-####################
-# application-legacy.conf
-####################
-
-configure_file("application-legacy.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application-legacy.conf" @ONLY)
-install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application-legacy.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
-add_test(application-legacy.conf.test "${CMAKE_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application-legacy.conf")
-
-####################
-# application-click.conf
-####################
-
-configure_file("application-click.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application-click.conf" @ONLY)
-install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application-click.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
-add_test(application-click.conf.test "${CMAKE_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application-click.conf")
-
-####################
-# application-failed.conf
-####################
-
-configure_file("application-failed.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application-failed.conf" @ONLY)
-install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application-failed.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
-add_test(application-failed.conf.test "${CMAKE_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application-failed.conf")
+# untrusted-helper-type-end
+####################
+
+add_executable(untrusted-helper-type-end untrusted-helper-type-end.c)
+set_target_properties(untrusted-helper-type-end PROPERTIES OUTPUT_NAME "untrusted-helper-type-end")
+target_link_libraries(untrusted-helper-type-end upstart-launcher)
+install(TARGETS untrusted-helper-type-end RUNTIME DESTINATION "${pkglibexecdir}")
 
 ####################
 # upstart-app-launch-desktop.click-hook
@@ -226,6 +158,8 @@
 configure_file("upstart-app-launch-desktop.click-hook.in" "${CMAKE_CURRENT_SOURCE_DIR}/debian/upstart-app-launch-desktop.click-hook" @ONLY)
 
 add_subdirectory(libupstart-app-launch)
+add_subdirectory(upstart-jobs)
+add_subdirectory(tools)
 
 # testing & coverage
 if (${enable_tests})

=== modified file 'MERGE-REVIEW'
--- MERGE-REVIEW	2014-01-29 19:29:26 +0000
+++ MERGE-REVIEW	2014-02-14 02:01:23 +0000
@@ -15,4 +15,6 @@
    * Run test case: upstart-app-launch/click-app
    * Run test case: upstart-app-launch/legacy-app
    * Run test case: upstart-app-launch/secondary-activation
+ * If this MR effect untrusted-helpers:
+   * Run test case: upstart-app-launch/helper-run
 

=== modified file 'debian/libupstart-app-launch2.symbols'
--- debian/libupstart-app-launch2.symbols	2014-02-13 13:14:48 +0000
+++ debian/libupstart-app-launch2.symbols	2014-02-14 02:01:23 +0000
@@ -1,6 +1,8 @@
 libupstart-app-launch.so.2 libupstart-app-launch2 #MINVER#
  upstart_app_launch_application_log_path@Base 0.3+14.04.20140213
  upstart_app_launch_get_primary_pid@Base 0.2
+ upstart_app_launch_list_helper_instances@Base 0replaceme
+ upstart_app_launch_list_helpers@Base 0replaceme
  upstart_app_launch_list_running_apps@Base 0.2
  upstart_app_launch_observer_add_app_failed@Base 0.2
  upstart_app_launch_observer_add_app_focus@Base 0.2
@@ -8,13 +10,21 @@
  upstart_app_launch_observer_add_app_started@Base 0.3+14.04.20131209
  upstart_app_launch_observer_add_app_starting@Base 0.3+14.04.20131209
  upstart_app_launch_observer_add_app_stop@Base 0.2
+ upstart_app_launch_observer_add_helper_started@Base 0replaceme
+ upstart_app_launch_observer_add_helper_stop@Base 0replaceme
  upstart_app_launch_observer_delete_app_failed@Base 0.2
  upstart_app_launch_observer_delete_app_focus@Base 0.2
  upstart_app_launch_observer_delete_app_resume@Base 0.2
  upstart_app_launch_observer_delete_app_started@Base 0.3+14.04.20131209
  upstart_app_launch_observer_delete_app_starting@Base 0.3+14.04.20131209
  upstart_app_launch_observer_delete_app_stop@Base 0.2
+ upstart_app_launch_observer_delete_helper_started@Base 0replaceme
+ upstart_app_launch_observer_delete_helper_stop@Base 0replaceme
  upstart_app_launch_pid_in_app_id@Base 0.2
  upstart_app_launch_start_application@Base 0.2
+ upstart_app_launch_start_helper@Base 0replaceme
+ upstart_app_launch_start_multiple_helper@Base 0replaceme
  upstart_app_launch_stop_application@Base 0.2
+ upstart_app_launch_stop_helper@Base 0replaceme
+ upstart_app_launch_stop_multiple_helper@Base 0replaceme
  upstart_app_launch_triplet_to_app_id@Base 0.3+14.04.20140129.1

=== modified file 'libupstart-app-launch/upstart-app-launch.c'
--- libupstart-app-launch/upstart-app-launch.c	2014-02-11 03:04:26 +0000
+++ libupstart-app-launch/upstart-app-launch.c	2014-02-14 02:01:23 +0000
@@ -63,6 +63,7 @@
 	GVariant * result = NULL;
 
 	tracepoint(upstart_app_launch, libual_start_message_callback, data->appid);
+
 	g_debug("Started Message Callback: %s", data->appid);
 
 	result = g_dbus_connection_call_finish(G_DBUS_CONNECTION(obj), res, &error);
@@ -1205,3 +1206,475 @@
 
 	return retval;
 }
+
+/* Print an error if we couldn't start it */
+static void
+start_helper_callback (GObject * obj, GAsyncResult * res, gpointer user_data)
+{
+	GError * error = NULL;
+	GVariant * result = NULL;
+
+	result = g_dbus_connection_call_finish(G_DBUS_CONNECTION(obj), res, &error);
+	if (result != NULL)
+		g_variant_unref(result);
+
+	if (error != NULL) {
+		g_warning("Unable to start helper: %s", error->message);
+		g_error_free(error);
+	}
+}
+
+/* Implements sending the "start" command to Upstart for the
+   untrusted helper job with the various configuration options
+   to define the instance.  In the end there's only one job with
+   an array of instances. */
+static gboolean
+start_helper_core (const gchar * type, const gchar * appid, const gchar * const * uris, const gchar * instance)
+{
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, FALSE);
+
+	const gchar * jobpath = get_jobpath(con, "untrusted-helper");
+
+	/* Build up our environment */
+	GVariantBuilder builder;
+	g_variant_builder_init(&builder, G_VARIANT_TYPE_TUPLE);
+	g_variant_builder_open(&builder, G_VARIANT_TYPE_ARRAY);
+	g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("APP_ID=%s", appid)));
+	g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("HELPER_TYPE=%s", type)));
+
+	if (uris != NULL) {
+		gchar * urisjoin = app_uris_string(uris);
+		g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("APP_URIS=%s", urisjoin)));
+		g_free(urisjoin);
+	}
+
+	if (instance != NULL) {
+		g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("INSTANCE_ID=%s", instance)));
+	}
+
+	g_variant_builder_close(&builder);
+	g_variant_builder_add_value(&builder, g_variant_new_boolean(TRUE));
+	
+	/* Call the job start function */
+	g_dbus_connection_call(con,
+	                       DBUS_SERVICE_UPSTART,
+	                       jobpath,
+	                       DBUS_INTERFACE_UPSTART_JOB,
+	                       "Start",
+	                       g_variant_builder_end(&builder),
+	                       NULL,
+	                       G_DBUS_CALL_FLAGS_NONE,
+	                       -1,
+	                       NULL, /* cancelable */
+	                       start_helper_callback,
+	                       NULL);
+
+	g_object_unref(con);
+
+	return TRUE;
+}
+
+gboolean
+upstart_app_launch_start_helper (const gchar * type, const gchar * appid, const gchar * const * uris)
+{
+	g_return_val_if_fail(type != NULL, FALSE);
+	g_return_val_if_fail(appid != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(type, -1, ":") == NULL, FALSE);
+
+	return start_helper_core(type, appid, uris, NULL);
+}
+
+gchar *
+upstart_app_launch_start_multiple_helper (const gchar * type, const gchar * appid, const gchar * const * uris)
+{
+	g_return_val_if_fail(type != NULL, NULL);
+	g_return_val_if_fail(appid != NULL, NULL);
+	g_return_val_if_fail(g_strstr_len(type, -1, ":") == NULL, NULL);
+
+	gchar * instanceid = g_strdup_printf("%" G_GUINT64_FORMAT, g_get_real_time());
+
+	if (start_helper_core(type, appid, uris, instanceid)) {
+		return instanceid;
+	}
+
+	g_free(instanceid);
+	return NULL;
+}
+
+/* Print an error if we couldn't stop it */
+static void
+stop_helper_callback (GObject * obj, GAsyncResult * res, gpointer user_data)
+{
+	GError * error = NULL;
+	GVariant * result = NULL;
+
+	result = g_dbus_connection_call_finish(G_DBUS_CONNECTION(obj), res, &error);
+	if (result != NULL)
+		g_variant_unref(result);
+
+	if (error != NULL) {
+		g_warning("Unable to stop helper: %s", error->message);
+		g_error_free(error);
+	}
+}
+
+/* Implements the basis of sending the stop message to Upstart for
+   an instance of the untrusted-helper job.  That also can have an
+   instance in that we allow for random instance ids to be used for
+   helpers that are not unique */
+static gboolean
+stop_helper_core (const gchar * type, const gchar * appid, const gchar * instanceid)
+{
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, FALSE);
+
+	const gchar * jobpath = get_jobpath(con, "untrusted-helper");
+
+	/* Build up our environment */
+	GVariantBuilder builder;
+	g_variant_builder_init(&builder, G_VARIANT_TYPE_TUPLE);
+	g_variant_builder_open(&builder, G_VARIANT_TYPE_ARRAY);
+	g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("APP_ID=%s", appid)));
+	g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("HELPER_TYPE=%s", type)));
+
+	if (instanceid != NULL) {
+		g_variant_builder_add_value(&builder, g_variant_new_take_string(g_strdup_printf("INSTANCE_ID=%s", instanceid)));
+	}
+
+	g_variant_builder_close(&builder);
+	g_variant_builder_add_value(&builder, g_variant_new_boolean(TRUE));
+	
+	/* Call the job start function */
+	g_dbus_connection_call(con,
+	                       DBUS_SERVICE_UPSTART,
+	                       jobpath,
+	                       DBUS_INTERFACE_UPSTART_JOB,
+	                       "Stop",
+	                       g_variant_builder_end(&builder),
+	                       NULL,
+	                       G_DBUS_CALL_FLAGS_NONE,
+	                       -1,
+	                       NULL, /* cancelable */
+	                       stop_helper_callback,
+	                       NULL);
+
+	g_object_unref(con);
+
+	return TRUE;
+}
+
+gboolean
+upstart_app_launch_stop_helper (const gchar * type, const gchar * appid)
+{
+	g_return_val_if_fail(type != NULL, FALSE);
+	g_return_val_if_fail(appid != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(type, -1, ":") == NULL, FALSE);
+
+	return stop_helper_core(type, appid, NULL);
+}
+
+gboolean
+upstart_app_launch_stop_multiple_helper (const gchar * type, const gchar * appid, const gchar * instanceid)
+{
+	g_return_val_if_fail(type != NULL, FALSE);
+	g_return_val_if_fail(appid != NULL, FALSE);
+	g_return_val_if_fail(instanceid != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(type, -1, ":") == NULL, FALSE);
+
+	return stop_helper_core(type, appid, instanceid);
+}
+
+
+typedef struct {
+	gchar * type_prefix; /* Type with the colon sperator */
+	size_t type_len;     /* Length in characters of the prefix */
+	GArray * retappids;  /* Array of appids to return */
+} helpers_helper_t;
+
+/* Look at each instance and see if it matches this type, if so
+   add the appid portion to the array of appids */
+static void
+list_helpers_helper (GDBusConnection * con, GVariant * props_dict, gpointer user_data)
+{
+	helpers_helper_t * data = (helpers_helper_t *)user_data;
+
+	GVariant * namev = g_variant_lookup_value(props_dict, "name", G_VARIANT_TYPE_STRING);
+	if (namev == NULL) {
+		return;
+	}
+
+	const gchar * name = g_variant_get_string(namev, NULL);
+	if (g_str_has_prefix(name, data->type_prefix)) {
+		/* Skip the type name */
+		name += data->type_len;
+
+		/* Skip a possible instance ID */
+		name = g_strstr_len(name, -1, ":");
+		name++;
+
+		/* Now copy the app id */
+		gchar * appid = g_strdup(name);
+		g_array_append_val(data->retappids, appid);
+	}
+
+	g_variant_unref(namev);
+
+	return;
+}
+
+gchar **
+upstart_app_launch_list_helpers (const gchar * type)
+{
+	g_return_val_if_fail(type != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(type, -1, ":") == NULL, FALSE);
+
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, FALSE);
+
+	helpers_helper_t helpers_helper_data = {
+		.type_prefix = g_strdup_printf("%s:", type),
+		.type_len = strlen(type) + 1, /* 1 for the colon */
+		.retappids = g_array_new(TRUE, TRUE, sizeof(gchar *))
+	};
+
+	foreach_job_instance(con, "untrusted-helper", list_helpers_helper, &helpers_helper_data);
+
+	g_object_unref(con);
+	g_free(helpers_helper_data.type_prefix);
+
+	return (gchar **)g_array_free(helpers_helper_data.retappids, FALSE);
+}
+
+typedef struct {
+	gchar * type_prefix; /* Type with the colon sperator */
+	size_t type_len;     /* Length in characters of the prefix */
+	GArray * retappids;  /* Array of appids to return */
+	gchar * appid_suffix; /* The appid for the end */
+} helper_instances_t;
+
+/* Look at each instance and see if it matches this type and appid.
+   If so, add the instance ID to the array of instance IDs */
+static void
+list_helper_instances (GDBusConnection * con, GVariant * props_dict, gpointer user_data)
+{
+	helper_instances_t * data = (helper_instances_t *)user_data;
+
+	GVariant * namev = g_variant_lookup_value(props_dict, "name", G_VARIANT_TYPE_STRING);
+	if (namev == NULL) {
+		return;
+	}
+
+	const gchar * name = g_variant_get_string(namev, NULL);
+	gchar * suffix_loc = NULL;
+	if (g_str_has_prefix(name, data->type_prefix) &&
+			(suffix_loc = g_strrstr(name, data->appid_suffix)) != NULL) {
+		/* Skip the type name */
+		name += data->type_len;
+
+		/* Now copy the instance id */
+		gchar * instanceid = g_strndup(name, suffix_loc - name);
+		g_array_append_val(data->retappids, instanceid);
+	}
+
+	g_variant_unref(namev);
+
+	return;
+}
+
+gchar **
+upstart_app_launch_list_helper_instances (const gchar * type, const gchar * appid)
+{
+	g_return_val_if_fail(type != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(type, -1, ":") == NULL, FALSE);
+
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, FALSE);
+
+	helper_instances_t helper_instances_data = {
+		.type_prefix = g_strdup_printf("%s:", type),
+		.type_len = strlen(type) + 1, /* 1 for the colon */
+		.retappids = g_array_new(TRUE, TRUE, sizeof(gchar *)),
+		.appid_suffix = g_strdup_printf(":%s", appid)
+	};
+
+	foreach_job_instance(con, "untrusted-helper", list_helper_instances, &helper_instances_data);
+
+	g_object_unref(con);
+	g_free(helper_instances_data.type_prefix);
+	g_free(helper_instances_data.appid_suffix);
+
+	return (gchar **)g_array_free(helper_instances_data.retappids, FALSE);
+}
+
+/* The data we keep for each observer */
+typedef struct _helper_observer_t helper_observer_t;
+struct _helper_observer_t {
+	GDBusConnection * conn;
+	guint sighandle;
+	gchar * type;
+	UpstartAppLaunchHelperObserver func;
+	gpointer user_data;
+};
+
+/* The lists of helper observers */
+static GList * helper_started_obs = NULL;
+static GList * helper_stopped_obs = NULL;
+
+static void
+helper_observer_cb (GDBusConnection * conn, const gchar * sender, const gchar * object, const gchar * interface, const gchar * signal, GVariant * params, gpointer user_data)
+{
+	helper_observer_t * observer = (helper_observer_t *)user_data;
+
+	gchar * env = NULL;
+	GVariant * envs = g_variant_get_child_value(params, 1);
+	GVariantIter iter;
+	g_variant_iter_init(&iter, envs);
+
+	gboolean job_found = FALSE;
+	gchar * instance = NULL;
+
+	while (g_variant_iter_loop(&iter, "s", &env)) {
+		if (g_strcmp0(env, "JOB=untrusted-helper") == 0) {
+			job_found = TRUE;
+		} else if (g_str_has_prefix(env, "INSTANCE=")) {
+			instance = g_strdup(env + strlen("INSTANCE="));
+		}
+	}
+
+	g_variant_unref(envs);
+
+	if (instance != NULL && !g_str_has_prefix(instance, observer->type)) {
+		g_free(instance);
+		instance = NULL;
+	}
+
+	gchar * appid = NULL;
+	gchar * instanceid = NULL;
+	gchar * type = NULL;
+
+	if (instance != NULL) {
+		gchar ** split = g_strsplit(instance, ":", 3);
+		type = split[0];
+		instanceid = split[1];
+		appid = split[2];
+		g_free(split);
+	}
+	g_free(instance);
+
+	if (instanceid != NULL && instanceid[0] == '\0') {
+		g_free(instanceid);
+		instanceid = NULL;
+	}
+
+	if (job_found && appid != NULL) {
+		observer->func(appid, instanceid, type, observer->user_data);
+	}
+
+	g_free(appid);
+	g_free(instanceid);
+	g_free(type);
+}
+
+/* Creates the observer structure and registers for the signal with
+   GDBus so that we can get a callback */
+static gboolean
+add_helper_generic (UpstartAppLaunchHelperObserver observer, const gchar * helper_type, gpointer user_data, const gchar * signal, GList ** list)
+{
+	GDBusConnection * conn = gdbus_upstart_ref();
+
+	if (conn == NULL) {
+		return FALSE;
+	}
+
+	helper_observer_t * observert = g_new0(helper_observer_t, 1);
+
+	observert->conn = conn;
+	observert->func = observer;
+	observert->user_data = user_data;
+	observert->type = g_strdup_printf("%s:", helper_type);
+
+	*list = g_list_prepend(*list, observert);
+
+	observert->sighandle = g_dbus_connection_signal_subscribe(conn,
+		NULL, /* sender */
+		DBUS_INTERFACE_UPSTART, /* interface */
+		"EventEmitted", /* signal */
+		DBUS_PATH_UPSTART, /* path */
+		signal, /* arg0 */
+		G_DBUS_SIGNAL_FLAGS_NONE,
+		helper_observer_cb,
+		observert,
+		NULL); /* user data destroy */
+
+	return TRUE;
+}
+
+static gboolean
+delete_helper_generic (UpstartAppLaunchHelperObserver observer, const gchar * type, gpointer user_data, GList ** list)
+{
+	helper_observer_t * observert = NULL;
+	GList * look;
+
+	for (look = *list; look != NULL; look = g_list_next(look)) {
+		observert = (helper_observer_t *)look->data;
+
+		if (observert->func == observer && observert->user_data == user_data && g_str_has_prefix(observert->type, type)) {
+			break;
+		}
+	}
+
+	if (look == NULL) {
+		return FALSE;
+	}
+
+	g_dbus_connection_signal_unsubscribe(observert->conn, observert->sighandle);
+	g_object_unref(observert->conn);
+
+	g_free(observert->type);
+	g_free(observert);
+	*list = g_list_delete_link(*list, look);
+
+	return TRUE;
+}
+
+gboolean
+upstart_app_launch_observer_add_helper_started (UpstartAppLaunchHelperObserver observer, const gchar * helper_type, gpointer user_data)
+{
+	g_return_val_if_fail(observer != NULL, FALSE);
+	g_return_val_if_fail(helper_type != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(helper_type, -1, ":") == NULL, FALSE);
+
+	return add_helper_generic(observer, helper_type, user_data, "started", &helper_started_obs);
+}
+
+gboolean
+upstart_app_launch_observer_add_helper_stop (UpstartAppLaunchHelperObserver observer, const gchar * helper_type, gpointer user_data)
+{
+	g_return_val_if_fail(observer != NULL, FALSE);
+	g_return_val_if_fail(helper_type != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(helper_type, -1, ":") == NULL, FALSE);
+
+	return add_helper_generic(observer, helper_type, user_data, "stopped", &helper_stopped_obs);
+}
+
+gboolean
+upstart_app_launch_observer_delete_helper_started (UpstartAppLaunchHelperObserver observer, const gchar * helper_type, gpointer user_data)
+{
+	g_return_val_if_fail(observer != NULL, FALSE);
+	g_return_val_if_fail(helper_type != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(helper_type, -1, ":") == NULL, FALSE);
+
+	return delete_helper_generic(observer, helper_type, user_data, &helper_started_obs);
+}
+
+gboolean
+upstart_app_launch_observer_delete_helper_stop (UpstartAppLaunchHelperObserver observer, const gchar * helper_type, gpointer user_data)
+{
+	g_return_val_if_fail(observer != NULL, FALSE);
+	g_return_val_if_fail(helper_type != NULL, FALSE);
+	g_return_val_if_fail(g_strstr_len(helper_type, -1, ":") == NULL, FALSE);
+
+	return delete_helper_generic(observer, helper_type, user_data, &helper_stopped_obs);
+}
+

=== modified file 'libupstart-app-launch/upstart-app-launch.h'
--- libupstart-app-launch/upstart-app-launch.h	2014-02-13 13:14:26 +0000
+++ libupstart-app-launch/upstart-app-launch.h	2014-02-14 02:01:23 +0000
@@ -59,6 +59,12 @@
 /* Backwards compatible.  Drop when making API bump. */
 typedef UpstartAppLaunchAppFailedObserver upstart_app_launch_app_failed_observer_t;
 
+/**
+ * UpstartAppLaunchHelperObserver:
+ *
+ * Function to watch for helpers that are starting and stopping
+ */
+typedef void (*UpstartAppLaunchHelperObserver) (const gchar * appid, const gchar * instanceid, const gchar * helpertype, gpointer user_data);
 
 /**
  * upstart_app_launch_start_application:
@@ -313,6 +319,152 @@
                                                          const gchar *                     app,
                                                          const gchar *                     version);
 
+/**
+ * upstart_app_launch_start_helper:
+ * @type: Type of helper
+ * @appid: App ID of the helper
+ * @uris: (allow-none) (array zero-terminated=1) (element-type utf8) (transfer none): A NULL terminated list of URIs to send to the helper
+ *
+ * Start an untrusted helper for a specific @type on a given
+ * @appid.  We don't know how that is done specifically, as Upstart
+ * will call a helper for that type.  And then execute it under the
+ * AppArmor profile for the helper as defined in its manifest.
+ *
+ * Return value: Whether the helper was able to be started
+ */
+gboolean   upstart_app_launch_start_helper              (const gchar *                     type,
+                                                         const gchar *                     appid,
+                                                         const gchar * const *             uris);
+
+/**
+ * upstart_app_launch_start_multiple_helper:
+ * @type: Type of helper
+ * @appid: App ID of the helper
+ * @uris: (allow-none) (array zero-terminated=1) (element-type utf8) (transfer none): A NULL terminated list of URIs to send to the helper
+ *
+ * Start an untrusted helper for a specific @type on a given
+ * @appid.  We don't know how that is done specifically, as Upstart
+ * will call a helper for that type.  And then execute it under the
+ * Apparmor profile for that helper type.  This function is different
+ * from @upstart_app_launch_start_helper in that it works for helpers
+ * that aren't single instance and the manager will be managing the
+ * instances as well.
+ *
+ * Return value: The generated instance ID or NULL on failure
+ */
+gchar *    upstart_app_launch_start_multiple_helper     (const gchar *                     type,
+                                                         const gchar *                     appid,
+                                                         const gchar * const *             uris);
+
+/**
+ * upstart_app_launch_stop_helper:
+ * @type: Type of helper
+ * @appid: App ID of the helper
+ *
+ * Asks Upstart to kill a helper.  In general, this should be a last resort
+ * as we should ask the helper a better way probably with an in-band protocol
+ * of use.
+ *
+ * Return value: Whether the helper is stopped
+ */
+gboolean   upstart_app_launch_stop_helper               (const gchar *                     type,
+                                                         const gchar *                     appid);
+
+/**
+ * upstart_app_launch_stop_multiple_helper:
+ * @type: Type of helper
+ * @appid: App ID of the helper
+ * @instanceid: The instance ID returned when starting the helper
+ *
+ * Asks Upstart to kill a helper.  In general, this should be a last resort
+ * as we should ask the helper a better way probably with an in-band protocol
+ * of use.
+ *
+ * Return value: Whether the helper is stopped
+ */
+gboolean   upstart_app_launch_stop_multiple_helper      (const gchar *                     type,
+                                                         const gchar *                     appid,
+                                                         const gchar *                     instanceid);
+
+/**
+ * upstart_app_launch_list_helpers:
+ * @type: Type of helper
+ *
+ * List all App IDs of helpers of a given @type.
+ *
+ * Return value: (transfer full): List of application IDs
+ */
+gchar **   upstart_app_launch_list_helpers              (const gchar *                     type);
+
+/**
+ * upstart_app_launch_list_helper_instances:
+ * @type: Type of helper
+ * @appid: AppID of helper
+ *
+ * List all the instances for a particular AppID
+ *
+ * Return value: (transfer full): List of instance IDs
+ */
+gchar **   upstart_app_launch_list_helper_instances     (const gchar *                     type,
+                                                         const gchar *                     appid);
+
+
+/**
+ * upstart_app_launch_observer_add_helper_started:
+ * @observer: (scope notified): Callback when a helper started
+ * @helper_type: (closure) (allow-none): Type of helpers to look for
+ * @user_data: (allow-none): Data to pass to the observer
+ *
+ * Sets up a callback to get called each time a helper of
+ * @helper_type has been started.
+ *
+ * Return value: Whether adding the observer was successful.
+ */
+gboolean   upstart_app_launch_observer_add_helper_started  (UpstartAppLaunchHelperObserver    observer,
+                                                            const gchar *                     helper_type,
+                                                            gpointer                          user_data);
+/**
+ * upstart_app_launch_observer_add_helper_stop:
+ * @observer: (scope notified): Callback when a helper stops
+ * @helper_type: (closure) (allow-none): Type of helpers to look for
+ * @user_data: (allow-none): Data to pass to the observer
+ *
+ * Sets up a callback to get called each time a helper of
+ * @helper_type stops.
+ *
+ * Return value: Whether adding the observer was successful.
+ */
+gboolean   upstart_app_launch_observer_add_helper_stop       (UpstartAppLaunchHelperObserver    observer,
+                                                              const gchar *                     helper_type,
+                                                              gpointer                          user_data);
+/**
+ * upstart_app_launch_observer_delete_helper_started:
+ * @observer: (scope notified): Callback to remove
+ * @helper_type: (closure) (allow-none): Type of helpers it looked for
+ * @user_data: (allow-none): Data that was passed to the observer
+ *
+ * Removes a previously registered callback to ensure it no longer
+ * gets signaled.
+ *
+ * Return value: Whether deleting the observer was successful.
+ */
+gboolean   upstart_app_launch_observer_delete_helper_started (UpstartAppLaunchHelperObserver    observer,
+                                                              const gchar *                     helper_type,
+                                                              gpointer                          user_data);
+/**
+ * upstart_app_launch_observer_delete_helper_stop:
+ * @observer: (scope notified): Callback to remove
+ * @helper_type: (closure) (allow-none): Type of helpers it looked for
+ * @user_data: (allow-none): Data that was passed to the observer
+ *
+ * Removes a previously registered callback to ensure it no longer
+ * gets signaled.
+ *
+ * Return value: Whether deleting the observer was successful.
+ */
+gboolean   upstart_app_launch_observer_delete_helper_stop    (UpstartAppLaunchHelperObserver    observer,
+                                                              const gchar *                     helper_type,
+                                                              gpointer                          user_data);
 
 #ifdef __cplusplus
 }

=== modified file 'tests/libual-test.cc'
--- tests/libual-test.cc	2014-02-13 13:14:14 +0000
+++ tests/libual-test.cc	2014-02-14 02:01:23 +0000
@@ -101,10 +101,13 @@
 				G_VARIANT_TYPE("o"),
 				"if args[0] == 'application-click':\n"
 				"	ret = dbus.ObjectPath('/com/test/application_click')\n"
-				"else:\n"
-				"	ret = dbus.ObjectPath('/com/test/application_legacy')\n",
+				"elif args[0] == 'application-legacy':\n"
+				"	ret = dbus.ObjectPath('/com/test/application_legacy')\n"
+				"elif args[0] == 'untrusted-helper':\n"
+				"	ret = dbus.ObjectPath('/com/test/untrusted/helper')\n",
 				NULL);
 
+			/* Click App */
 			DbusTestDbusMockObject * jobobj = dbus_test_dbus_mock_get_object(mock, "/com/test/application_click", "com.ubuntu.Upstart0_6.Job", NULL);
 
 			dbus_test_dbus_mock_object_add_method(mock, jobobj,
@@ -143,6 +146,7 @@
 				NULL);
 			g_free(process_var);
 
+			/*  Legacy App */
 			DbusTestDbusMockObject * ljobobj = dbus_test_dbus_mock_get_object(mock, "/com/test/application_legacy", "com.ubuntu.Upstart0_6.Job", NULL);
 
 			dbus_test_dbus_mock_object_add_method(mock, ljobobj,
@@ -178,6 +182,45 @@
 				g_variant_new_parsed("[('main', 5678)]"),
 				NULL);
 
+			/*  Untrusted Helper */
+			DbusTestDbusMockObject * uhelperobj = dbus_test_dbus_mock_get_object(mock, "/com/test/untrusted/helper", "com.ubuntu.Upstart0_6.Job", NULL);
+
+			dbus_test_dbus_mock_object_add_method(mock, uhelperobj,
+				"Start",
+				G_VARIANT_TYPE("(asb)"),
+				NULL,
+				"",
+				NULL);
+
+			dbus_test_dbus_mock_object_add_method(mock, uhelperobj,
+				"Stop",
+				G_VARIANT_TYPE("(asb)"),
+				NULL,
+				"",
+				NULL);
+
+			dbus_test_dbus_mock_object_add_method(mock, uhelperobj,
+				"GetAllInstances",
+				NULL,
+				G_VARIANT_TYPE("ao"),
+				"ret = [ dbus.ObjectPath('/com/test/untrusted/helper/instance'), dbus.ObjectPath('/com/test/untrusted/helper/multi_instance') ]",
+				NULL);
+
+			DbusTestDbusMockObject * uhelperinstance = dbus_test_dbus_mock_get_object(mock, "/com/test/untrusted/helper/instance", "com.ubuntu.Upstart0_6.Instance", NULL);
+			dbus_test_dbus_mock_object_add_property(mock, uhelperinstance,
+				"name",
+				G_VARIANT_TYPE_STRING,
+				g_variant_new_string("untrusted-type::com.foo_bar_43.23.12"),
+				NULL);
+
+			DbusTestDbusMockObject * unhelpermulti = dbus_test_dbus_mock_get_object(mock, "/com/test/untrusted/helper/multi_instance", "com.ubuntu.Upstart0_6.Instance", NULL);
+			dbus_test_dbus_mock_object_add_property(mock, unhelpermulti,
+				"name",
+				G_VARIANT_TYPE_STRING,
+				g_variant_new_string("untrusted-type:24034582324132:com.bar_foo_8432.13.1"),
+				NULL);
+
+			/* Put it together */
 			dbus_test_service_add_task(service, DBUS_TEST_TASK(mock));
 			dbus_test_service_start_tasks(service);
 
@@ -219,11 +262,15 @@
 						return false;
 					}
 
-					gchar * combined = g_strdup_printf("%s=%s", var, value);
-					if (g_strcmp0(envvar, combined) == 0) {
+					if (value != NULL) {
+						gchar * combined = g_strdup_printf("%s=%s", var, value);
+						if (g_strcmp0(envvar, combined) == 0) {
+							found = true;
+						}
+						g_free(combined);
+					} else {
 						found = true;
 					}
-					g_free(combined);
 				}
 			}
 
@@ -838,3 +885,258 @@
 	g_object_unref(session);
 }
 
+TEST_F(LibUAL, StartHelper)
+{
+	DbusTestDbusMockObject * obj = dbus_test_dbus_mock_get_object(mock, "/com/test/untrusted/helper", "com.ubuntu.Upstart0_6.Job", NULL);
+
+	/* Basic make sure we can send the event */
+	ASSERT_TRUE(upstart_app_launch_start_helper("untrusted-type", "foolike", NULL));
+	EXPECT_EQ(1, dbus_test_dbus_mock_object_check_method_call(mock, obj, "Start", NULL, NULL));
+
+	ASSERT_TRUE(dbus_test_dbus_mock_object_clear_method_calls(mock, obj, NULL));
+
+	/* Now look at the details of the call */
+	ASSERT_TRUE(upstart_app_launch_start_helper("untrusted-type", "foolike", NULL));
+
+	guint len = 0;
+	const DbusTestDbusMockCall * calls = dbus_test_dbus_mock_object_get_method_calls(mock, obj, "Start", &len, NULL);
+	EXPECT_NE(nullptr, calls);
+	EXPECT_EQ(1, len);
+
+	EXPECT_STREQ("Start", calls->name);
+	EXPECT_EQ(2, g_variant_n_children(calls->params));
+
+	GVariant * block = g_variant_get_child_value(calls->params, 1);
+	EXPECT_TRUE(g_variant_get_boolean(block));
+	g_variant_unref(block);
+
+	GVariant * env = g_variant_get_child_value(calls->params, 0);
+	EXPECT_TRUE(check_env(env, "APP_ID", "foolike"));
+	EXPECT_TRUE(check_env(env, "HELPER_TYPE", "untrusted-type"));
+	EXPECT_FALSE(check_env(env, "INSTANCE_ID", NULL));
+	g_variant_unref(env);
+
+	ASSERT_TRUE(dbus_test_dbus_mock_object_clear_method_calls(mock, obj, NULL));
+
+	/* Now check a multi out */ 
+	gchar * instance_id = upstart_app_launch_start_multiple_helper("untrusted-type", "foolike", NULL);
+	ASSERT_NE(nullptr, instance_id);
+	g_debug("Multi-instance ID: %s", instance_id);
+
+	len = 0;
+	calls = dbus_test_dbus_mock_object_get_method_calls(mock, obj, "Start", &len, NULL);
+	EXPECT_NE(nullptr, calls);
+	EXPECT_EQ(1, len);
+
+	EXPECT_STREQ("Start", calls->name);
+	EXPECT_EQ(2, g_variant_n_children(calls->params));
+
+	block = g_variant_get_child_value(calls->params, 1);
+	EXPECT_TRUE(g_variant_get_boolean(block));
+	g_variant_unref(block);
+
+	env = g_variant_get_child_value(calls->params, 0);
+	EXPECT_TRUE(check_env(env, "APP_ID", "foolike"));
+	EXPECT_TRUE(check_env(env, "HELPER_TYPE", "untrusted-type"));
+	EXPECT_TRUE(check_env(env, "INSTANCE_ID", instance_id));
+	g_variant_unref(env);
+	g_free(instance_id);
+
+	ASSERT_TRUE(dbus_test_dbus_mock_object_clear_method_calls(mock, obj, NULL));
+
+	/* Let's pass some URLs */
+	const gchar * urls[] = {
+		"http://ubuntu.com/",
+		"https://ubuntu.com/",
+		"file:///home/phablet/test.txt",
+		NULL
+	};
+	ASSERT_TRUE(upstart_app_launch_start_helper("untrusted-type", "foolike", urls));
+
+	len = 0;
+	calls = dbus_test_dbus_mock_object_get_method_calls(mock, obj, "Start", &len, NULL);
+	EXPECT_NE(nullptr, calls);
+	EXPECT_EQ(1, len);
+
+	env = g_variant_get_child_value(calls->params, 0);
+	EXPECT_TRUE(check_env(env, "APP_ID", "foolike"));
+	EXPECT_TRUE(check_env(env, "APP_URIS", "'http://ubuntu.com/' 'https://ubuntu.com/' 'file:///home/phablet/test.txt'"));
+	EXPECT_TRUE(check_env(env, "HELPER_TYPE", "untrusted-type"));
+	EXPECT_FALSE(check_env(env, "INSTANCE_ID", NULL));
+	g_variant_unref(env);
+
+	return;
+}
+
+TEST_F(LibUAL, StopHelper)
+{
+	DbusTestDbusMockObject * obj = dbus_test_dbus_mock_get_object(mock, "/com/test/untrusted/helper", "com.ubuntu.Upstart0_6.Job", NULL);
+
+	/* Basic helper */
+	ASSERT_TRUE(upstart_app_launch_stop_helper("untrusted-type", "foo"));
+
+	ASSERT_EQ(dbus_test_dbus_mock_object_check_method_call(mock, obj, "Stop", NULL, NULL), 1);
+
+	guint len = 0;
+	const DbusTestDbusMockCall * calls = dbus_test_dbus_mock_object_get_method_calls(mock, obj, "Stop", &len, NULL);
+	EXPECT_NE(nullptr, calls);
+	EXPECT_EQ(1, len);
+
+	EXPECT_STREQ("Stop", calls->name);
+	EXPECT_EQ(2, g_variant_n_children(calls->params));
+
+	GVariant * block = g_variant_get_child_value(calls->params, 1);
+	EXPECT_TRUE(g_variant_get_boolean(block));
+	g_variant_unref(block);
+
+	GVariant * env = g_variant_get_child_value(calls->params, 0);
+	EXPECT_TRUE(check_env(env, "APP_ID", "foo"));
+	EXPECT_TRUE(check_env(env, "HELPER_TYPE", "untrusted-type"));
+	EXPECT_FALSE(check_env(env, "INSTANCE_ID", NULL));
+	g_variant_unref(env);
+
+	ASSERT_TRUE(dbus_test_dbus_mock_object_clear_method_calls(mock, obj, NULL));
+
+	/* Multi helper */
+	ASSERT_TRUE(upstart_app_launch_stop_multiple_helper("untrusted-type", "foo", "instance-me"));
+
+	ASSERT_EQ(dbus_test_dbus_mock_object_check_method_call(mock, obj, "Stop", NULL, NULL), 1);
+
+	len = 0;
+	calls = dbus_test_dbus_mock_object_get_method_calls(mock, obj, "Stop", &len, NULL);
+	EXPECT_NE(nullptr, calls);
+	EXPECT_EQ(1, len);
+
+	EXPECT_STREQ("Stop", calls->name);
+	EXPECT_EQ(2, g_variant_n_children(calls->params));
+
+	block = g_variant_get_child_value(calls->params, 1);
+	EXPECT_TRUE(g_variant_get_boolean(block));
+	g_variant_unref(block);
+
+	env = g_variant_get_child_value(calls->params, 0);
+	EXPECT_TRUE(check_env(env, "APP_ID", "foo"));
+	EXPECT_TRUE(check_env(env, "HELPER_TYPE", "untrusted-type"));
+	EXPECT_TRUE(check_env(env, "INSTANCE_ID", "instance-me"));
+	g_variant_unref(env);
+
+	ASSERT_TRUE(dbus_test_dbus_mock_object_clear_method_calls(mock, obj, NULL));
+
+	return;
+}
+
+TEST_F(LibUAL, HelperList)
+{
+	gchar ** blanktype = upstart_app_launch_list_helpers("not-a-type");
+
+	EXPECT_NE(nullptr, blanktype);
+	EXPECT_EQ(0, g_strv_length(blanktype));
+
+	g_strfreev(blanktype);
+
+	gchar ** goodtype = upstart_app_launch_list_helpers("untrusted-type");
+
+	EXPECT_NE(nullptr, goodtype);
+	EXPECT_EQ(2, g_strv_length(goodtype));
+
+	if (g_strcmp0(goodtype[0], "com.foo_bar_43.23.12") == 0) {
+		EXPECT_STREQ("com.foo_bar_43.23.12", goodtype[0]);
+		EXPECT_STREQ("com.bar_foo_8432.13.1", goodtype[1]);
+	} else {
+		EXPECT_STREQ("com.foo_bar_43.23.12", goodtype[1]);
+		EXPECT_STREQ("com.bar_foo_8432.13.1", goodtype[0]);
+	}
+
+	g_strfreev(goodtype);
+}
+
+TEST_F(LibUAL, HelperInstanceList)
+{
+	gchar ** blanktype = upstart_app_launch_list_helper_instances("not-a-type", "com.bar_foo_8432.13.1");
+
+	EXPECT_NE(nullptr, blanktype);
+	EXPECT_EQ(0, g_strv_length(blanktype));
+
+	g_strfreev(blanktype);
+
+	gchar ** goodtype = upstart_app_launch_list_helper_instances("untrusted-type", "com.bar_foo_8432.13.1");
+
+	EXPECT_NE(nullptr, goodtype);
+	EXPECT_EQ(1, g_strv_length(goodtype));
+	EXPECT_STREQ("24034582324132", goodtype[0]);
+
+	g_strfreev(goodtype);
+}
+
+
+typedef struct {
+	unsigned int count;
+	const gchar * appid;
+	const gchar * type;
+	const gchar * instance;
+} helper_observer_data_t;
+
+static void
+helper_observer_cb (const gchar * appid, const gchar * instance, const gchar * type, gpointer user_data)
+{
+	helper_observer_data_t * data = (helper_observer_data_t *)user_data;
+
+	if (g_strcmp0(data->appid, appid) == 0 &&
+		g_strcmp0(data->type, type) == 0 &&
+		g_strcmp0(data->instance, instance) == 0) {
+		data->count++;
+	}
+}
+
+TEST_F(LibUAL, StartStopHelperObserver)
+{
+	helper_observer_data_t start_data = {
+		.count = 0,
+		.appid = "com.foo_foo_1.2.3",
+		.type = "my-type-is-scorpio",
+		.instance = nullptr
+	};
+	helper_observer_data_t stop_data = {
+		.count = 0,
+		.appid = "com.bar_bar_44.32",
+		.type = "my-type-is-libra",
+		.instance = "1234"
+	};
+
+	ASSERT_TRUE(upstart_app_launch_observer_add_helper_started(helper_observer_cb, "my-type-is-scorpio", &start_data));
+	ASSERT_TRUE(upstart_app_launch_observer_add_helper_stop(helper_observer_cb, "my-type-is-libra", &stop_data));
+
+	DbusTestDbusMockObject * obj = dbus_test_dbus_mock_get_object(mock, "/com/ubuntu/Upstart", "com.ubuntu.Upstart0_6", NULL);
+
+	/* Basic start */
+	dbus_test_dbus_mock_object_emit_signal(mock, obj,
+		"EventEmitted",
+		G_VARIANT_TYPE("(sas)"),
+		g_variant_new_parsed("('started', ['JOB=untrusted-helper', 'INSTANCE=my-type-is-scorpio::com.foo_foo_1.2.3'])"),
+		NULL
+	);
+
+	g_usleep(100000);
+	while (g_main_pending())
+		g_main_iteration(TRUE);
+
+	ASSERT_EQ(start_data.count, 1);
+
+	/* Basic stop */
+	dbus_test_dbus_mock_object_emit_signal(mock, obj,
+		"EventEmitted",
+		G_VARIANT_TYPE("(sas)"),
+		g_variant_new_parsed("('stopped', ['JOB=untrusted-helper', 'INSTANCE=my-type-is-libra:1234:com.bar_bar_44.32'])"),
+		NULL
+	);
+
+	g_usleep(100000);
+	while (g_main_pending())
+		g_main_iteration(TRUE);
+
+	ASSERT_EQ(stop_data.count, 1);
+
+	/* Remove */
+	ASSERT_TRUE(upstart_app_launch_observer_delete_helper_started(helper_observer_cb, "my-type-is-scorpio", &start_data));
+	ASSERT_TRUE(upstart_app_launch_observer_delete_helper_stop(helper_observer_cb, "my-type-is-libra", &stop_data));
+}

=== modified file 'tests/manual'
--- tests/manual	2014-02-04 21:24:12 +0000
+++ tests/manual	2014-02-14 02:01:23 +0000
@@ -28,6 +28,21 @@
         <dd>The settings application should come back into focus and be on the power settings pane</dd>
 </dl>
 
+Test-case upstart-app-launch/helper-run
+<dl>
+    <dt>NOTE: Test is theoretical today, needs other components to be written</dt>
+    <dt>Get a device that supports sending SMS</dt>
+        <dd>Typically this is a phone</dd>
+    <dt>Note the SMS sent count visible on the lock screen infographic for this user</dt>
+    <dt>Start the messaging app</dt>
+    <dt>Send an SMS</dt>
+        <dd>SMS should report as being sent successfully</dd>
+    <dt>Wait approximately 1 minute</dt>
+        <dd>Screen should lock</dd>
+    <dt>Look at the lock screen infographic for the SMS sent count</dt>
+        <dd>Count should have incremented by 1</dd>
+</dl>
+
 Test-case upstart-app-launch/security-app-launch
 <dl>
     <dt>Setup the security tests: https://wiki.ubuntu.com/Touch/Testing#Running_Security_tests</dt>

=== added directory 'tools'
=== added file 'tools/CMakeLists.txt'
--- tools/CMakeLists.txt	1970-01-01 00:00:00 +0000
+++ tools/CMakeLists.txt	2014-02-14 02:01:23 +0000
@@ -0,0 +1,73 @@
+
+########################
+# upstart-app-list
+########################
+
+add_executable(upstart-app-list upstart-app-list.c)
+set_target_properties(upstart-app-list PROPERTIES OUTPUT_NAME "upstart-app-list")
+target_link_libraries(upstart-app-list upstart-launcher)
+install(TARGETS upstart-app-list RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-app-launch
+########################
+
+add_executable(upstart-app-launch upstart-app-launch.c)
+set_target_properties(upstart-app-launch PROPERTIES OUTPUT_NAME "upstart-app-launch")
+target_link_libraries(upstart-app-launch upstart-launcher)
+install(TARGETS upstart-app-launch RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-app-watch
+########################
+
+add_executable(upstart-app-watch upstart-app-watch.c)
+set_target_properties(upstart-app-watch PROPERTIES OUTPUT_NAME "upstart-app-watch")
+target_link_libraries(upstart-app-watch upstart-launcher)
+install(TARGETS upstart-app-watch RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-app-pid
+########################
+
+add_executable(upstart-app-pid upstart-app-pid.c)
+set_target_properties(upstart-app-pid PROPERTIES OUTPUT_NAME "upstart-app-pid")
+target_link_libraries(upstart-app-pid upstart-launcher)
+install(TARGETS upstart-app-pid RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-app-stop
+########################
+
+add_executable(upstart-app-stop upstart-app-stop.c)
+set_target_properties(upstart-app-stop PROPERTIES OUTPUT_NAME "upstart-app-stop")
+target_link_libraries(upstart-app-stop upstart-launcher)
+install(TARGETS upstart-app-stop RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-helper-start
+########################
+
+add_executable(upstart-helper-start upstart-helper-start.c)
+set_target_properties(upstart-helper-start PROPERTIES OUTPUT_NAME "upstart-helper-start")
+target_link_libraries(upstart-helper-start upstart-launcher)
+install(TARGETS upstart-helper-start RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-helper-stop
+########################
+
+add_executable(upstart-helper-stop upstart-helper-stop.c)
+set_target_properties(upstart-helper-stop PROPERTIES OUTPUT_NAME "upstart-helper-stop")
+target_link_libraries(upstart-helper-stop upstart-launcher)
+install(TARGETS upstart-helper-stop RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+
+########################
+# upstart-helper-list
+########################
+
+add_executable(upstart-helper-list upstart-helper-list.c)
+set_target_properties(upstart-helper-list PROPERTIES OUTPUT_NAME "upstart-helper-list")
+target_link_libraries(upstart-helper-list upstart-launcher)
+install(TARGETS upstart-helper-list RUNTIME DESTINATION "${CMAKE_INSTALL_FULL_BINDIR}")
+

=== renamed file 'upstart-app-launch.c' => 'tools/upstart-app-launch.c'
=== renamed file 'upstart-app-list.c' => 'tools/upstart-app-list.c'
=== renamed file 'upstart-app-pid.c' => 'tools/upstart-app-pid.c'
=== renamed file 'upstart-app-stop.c' => 'tools/upstart-app-stop.c'
=== renamed file 'upstart-app-watch.c' => 'tools/upstart-app-watch.c'
=== added file 'tools/upstart-helper-list.c'
--- tools/upstart-helper-list.c	1970-01-01 00:00:00 +0000
+++ tools/upstart-helper-list.c	2014-02-14 02:01:23 +0000
@@ -0,0 +1,50 @@
+/*
+ * Copyright © 2014 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 3, as published
+ * by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranties of
+ * MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+ * PURPOSE.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authors:
+ *     Ted Gould <[e-mail]>
+ */
+
+#include "libupstart-app-launch/upstart-app-launch.h"
+#include <gio/gio.h>
+
+int
+main (int argc, gchar * argv[]) {
+	if (argc != 2) {
+		g_printerr("Usage: %s <helper type>\n", argv[0]);
+		return 1;
+	}
+
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, -1);
+
+	gchar ** appids = upstart_app_launch_list_helpers(argv[1]);
+	if (appids == NULL) {
+		g_warning("Error getting App IDs for helper type '%s'", argv[1]);
+		return -1;
+	}
+
+	int i;
+	for (i = 0; appids[i] != NULL; i++) {
+		g_print("%s\n", appids[i]);
+	}
+
+	g_strfreev(appids);
+
+	g_dbus_connection_flush_sync(con, NULL, NULL);
+	g_object_unref(con);
+
+	return 0;
+}

=== added file 'tools/upstart-helper-start.c'
--- tools/upstart-helper-start.c	1970-01-01 00:00:00 +0000
+++ tools/upstart-helper-start.c	2014-02-14 02:01:23 +0000
@@ -0,0 +1,46 @@
+/*
+ * Copyright © 2014 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 3, as published
+ * by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranties of
+ * MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+ * PURPOSE.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authors:
+ *     Ted Gould <[e-mail]>
+ */
+
+#include "libupstart-app-launch/upstart-app-launch.h"
+#include <gio/gio.h>
+
+int
+main (int argc, gchar * argv[]) {
+	if (argc != 3) {
+		g_printerr("Usage: %s <helper type> <app id>\n", argv[0]);
+		return 1;
+	}
+
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, -1);
+
+	int retval = -1;
+
+	/* TODO: Allow URIs */
+	if (upstart_app_launch_start_helper(argv[1], argv[2], NULL)) {
+		retval = 0;
+	} else {
+		g_debug("Unable to start app id '%s' of type '%s'", argv[2], argv[1]);
+	}
+
+	g_dbus_connection_flush_sync(con, NULL, NULL);
+	g_object_unref(con);
+
+	return retval; 
+}

=== added file 'tools/upstart-helper-stop.c'
--- tools/upstart-helper-stop.c	1970-01-01 00:00:00 +0000
+++ tools/upstart-helper-stop.c	2014-02-14 02:01:23 +0000
@@ -0,0 +1,45 @@
+/*
+ * Copyright © 2014 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 3, as published
+ * by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranties of
+ * MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+ * PURPOSE.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authors:
+ *     Ted Gould <[e-mail]>
+ */
+
+#include "libupstart-app-launch/upstart-app-launch.h"
+#include <gio/gio.h>
+
+int
+main (int argc, gchar * argv[]) {
+	if (argc != 3) {
+		g_printerr("Usage: %s <helper type> <app id>\n", argv[0]);
+		return 1;
+	}
+
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, -1);
+
+	int retval = -1;
+
+	if (upstart_app_launch_stop_helper(argv[1], argv[2])) {
+		retval = 0;
+	} else {
+		g_debug("Unable to stop app id '%s' of type '%s'", argv[2], argv[1]);
+	}
+
+	g_dbus_connection_flush_sync(con, NULL, NULL);
+	g_object_unref(con);
+
+	return retval;
+}

=== added file 'untrusted-helper-type-end.c'
--- untrusted-helper-type-end.c	1970-01-01 00:00:00 +0000
+++ untrusted-helper-type-end.c	2014-02-14 02:01:23 +0000
@@ -0,0 +1,66 @@
+/*
+ * Copyright © 2014 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 3, as published
+ * by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranties of
+ * MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+ * PURPOSE.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authors:
+ *     Ted Gould <[e-mail]>
+ */
+
+#include "libupstart-app-launch/upstart-app-launch.h"
+#include <gio/gio.h>
+
+int
+main (int argc, gchar * argv[]) {
+	const gchar * type = g_getenv("HELPER_TYPE");
+	g_return_val_if_fail(type != NULL, -1);
+
+	GDBusConnection * con = g_bus_get_sync(G_BUS_TYPE_SESSION, NULL, NULL);
+	g_return_val_if_fail(con != NULL, -1);
+
+	gchar ** appids = upstart_app_launch_list_helpers(type);
+	if (appids == NULL) {
+		g_warning("Error getting App IDs for helper type '%s'", argv[1]);
+		return -1;
+	}
+
+	int i;
+	for (i = 0; appids[i] != NULL; i++) {
+		gchar ** instances = upstart_app_launch_list_helper_instances(type, appids[i]);
+		guint instance_cnt = g_strv_length(instances);
+
+		if (instance_cnt == 0) {
+			g_debug("Stopping %s", appids[i]);
+			if (!upstart_app_launch_stop_helper(type, appids[i])) {
+				g_warning("Unable to stop '%s'", appids[i]);
+			}
+		} else {
+			int j;
+			for (j = 0; j < instance_cnt; j++) {
+				g_debug("Stopping %s (%s)", appids[i], instances[j]);
+				if (!upstart_app_launch_stop_multiple_helper(type, appids[i], instances[j])) {
+					g_warning("Unable to stop '%s' instance '%s'", appids[i], instances[j]);
+				}
+			}
+		}
+
+		g_strfreev(instances);
+	}
+
+	g_strfreev(appids);
+
+	g_dbus_connection_flush_sync(con, NULL, NULL);
+	g_object_unref(con);
+
+	return 0;
+}

=== added directory 'upstart-jobs'
=== added file 'upstart-jobs/CMakeLists.txt'
--- upstart-jobs/CMakeLists.txt	1970-01-01 00:00:00 +0000
+++ upstart-jobs/CMakeLists.txt	2014-02-14 02:01:23 +0000
@@ -0,0 +1,49 @@
+
+####################
+# application.conf
+####################
+
+configure_file("application.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application.conf" @ONLY)
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
+add_test(application.conf.test "${CMAKE_CURRENT_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application.conf")
+
+####################
+# application-legacy.conf
+####################
+
+configure_file("application-legacy.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application-legacy.conf" @ONLY)
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application-legacy.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
+add_test(application-legacy.conf.test "${CMAKE_CURRENT_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application-legacy.conf")
+
+####################
+# application-click.conf
+####################
+
+configure_file("application-click.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application-click.conf" @ONLY)
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application-click.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
+add_test(application-click.conf.test "${CMAKE_CURRENT_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application-click.conf")
+
+####################
+# application-failed.conf
+####################
+
+configure_file("application-failed.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/application-failed.conf" @ONLY)
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/application-failed.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
+add_test(application-failed.conf.test "${CMAKE_CURRENT_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/application-failed.conf")
+
+####################
+# untrusted-helper.conf
+####################
+
+configure_file("untrusted-helper.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/untrusted-helper.conf" @ONLY)
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/untrusted-helper.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
+add_test(untrusted-helper.conf.test "${CMAKE_CURRENT_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/untrusted-helper.conf")
+
+####################
+# untrusted-helper-type-end.conf
+####################
+
+configure_file("untrusted-helper-type-end.conf.in" "${CMAKE_CURRENT_BINARY_DIR}/untrusted-helper-type-end.conf" @ONLY)
+install(FILES "${CMAKE_CURRENT_BINARY_DIR}/untrusted-helper-type-end.conf" DESTINATION "${CMAKE_INSTALL_DATADIR}/upstart/sessions")
+add_test(untrusted-helper-type-end.conf.test "${CMAKE_CURRENT_SOURCE_DIR}/test-conffile.sh" "${CMAKE_CURRENT_BINARY_DIR}/untrusted-helper-type-end.conf")
+

=== renamed file 'application-click.conf.in' => 'upstart-jobs/application-click.conf.in'
=== renamed file 'application-failed.conf.in' => 'upstart-jobs/application-failed.conf.in'
=== renamed file 'application-legacy.conf.in' => 'upstart-jobs/application-legacy.conf.in'
=== renamed file 'application.conf.in' => 'upstart-jobs/application.conf.in'
=== renamed file 'test-conffile.sh' => 'upstart-jobs/test-conffile.sh'
=== added file 'upstart-jobs/untrusted-helper-type-end.conf.in'
--- upstart-jobs/untrusted-helper-type-end.conf.in	1970-01-01 00:00:00 +0000
+++ upstart-jobs/untrusted-helper-type-end.conf.in	2014-02-14 02:01:23 +0000
@@ -0,0 +1,9 @@
+description "End all untrusted helpers of a particular type, usually when the manager ends"
+
+start on untrusted-helper-type-end
+
+instance ${HELPER_TYPE}
+
+emits untrusted-helper-end
+
+exec @pkglibexecdir@/untrusted-helper-type-end

=== added file 'upstart-jobs/untrusted-helper.conf.in'
--- upstart-jobs/untrusted-helper.conf.in	1970-01-01 00:00:00 +0000
+++ upstart-jobs/untrusted-helper.conf.in	2014-02-14 02:01:23 +0000
@@ -0,0 +1,31 @@
+description "Untrusted Helpers installed from Click Packages"
+
+start on untrusted-helper-start
+stop on untrusted-helper-end or desktop-end
+
+instance ${HELPER_TYPE}:${INSTANCE_ID}:${APP_ID}
+
+env APP_ID
+env APP_EXEC="echo Error"
+env HELPER_TYPE
+env INSTANCE_ID=""
+env APP_URIS
+
+env UPSTART_APP_LAUNCH_ARCH="@upstart_app_launch_arch@"
+export UPSTART_APP_LAUNCH_ARCH
+
+apparmor switch ${APP_ID}
+oom score 800
+
+# This is unconfined
+pre-start script
+	if [ -x "@pkglibexecdir@/${HELPER_TYPE}/exec-tool" ] ; then
+		@pkglibexecdir@/${HELPER_TYPE}/exec-tool
+	else
+		echo "Unable to find exec tool for ${HELPER_TYPE}"
+		exit -1
+	fi
+end script
+
+# Remember, this is confined
+exec @pkglibexecdir@/exec-line-exec